Facial Anonymization and Privacy Concerns in Total-Body PET/CT.

Total-body PET/CT images can be rendered to produce images of a subject's face and body. In response to privacy and identifiability concerns when sharing data, we have developed and validated a workflow that obscures (defaces) a subject's face in 3-dimensional volumetric data. To validate our method, we measured facial identifiability before and after defacing images from 30 healthy subjects who were imaged with both [F]FDG PET and CT at either 3 or 6 time points. Briefly, facial embeddings were calculated using Google's FaceNet, and an analysis of clustering was used to estimate identifiability. Faces rendered from CT images were correctly matched to CT scans at other time points at a rate of 93%, which decreased to 6% after defacing. Faces rendered from PET images were correctly matched to PET images at other time points at a maximum rate of 64% and to CT images at a maximum rate of 50%, both of which decreased to 7% after defacing. We further demonstrated that defaced CT images can be used for attenuation correction during PET reconstruction, introducing a maximum bias of -3.3% in regions of the cerebral cortex nearest the face. We believe that the proposed method provides a baseline of anonymity and discretion when sharing image data online or between institutions and will help to facilitate collaboration and future regulatory compliance.